Headline
Debian Security Advisory 5427-1
Debian Linux Security Advisory 5427-1 - An anonymous researcher discovered that processing web content may disclose sensitive information. Apple is aware of a report that this issue may have been actively exploited. An anonymous researcher discovered that processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Debian Security Advisory DSA-5427-1 [email protected]
https://www.debian.org/security/ Alberto Garcia
June 15, 2023 https://www.debian.org/security/faq
Package : webkit2gtk
CVE ID : CVE-2023-28204 CVE-2023-32373
The following vulnerabilities have been discovered in the WebKitGTK
web engine:
CVE-2023-28204
An anonymous researcher discovered that processing web content may
disclose sensitive information. Apple is aware of a report that
this issue may have been actively exploited.
CVE-2023-32373
An anonymous researcher discovered that processing maliciously
crafted web content may lead to arbitrary code execution. Apple is
aware of a report that this issue may have been actively
exploited.
For the oldstable distribution (bullseye), these problems have been fixed
in version 2.40.2-1~deb11u1.
For the stable distribution (bookworm), these problems have been fixed in
version 2.40.2-1~deb12u1.
We recommend that you upgrade your webkit2gtk packages.
For the detailed security status of webkit2gtk please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/webkit2gtk
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: [email protected]
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEEYrwugQBKzlHMYFizAAyEYu0C2AIFAmSK0g8ACgkQAAyEYu0C
2AIVPg//Vh8OJD3fkTkB8ePh5jwWASA23wSZXKZ3PH3MbZu7bVHkJxkNrAjz7pkN
PRdgVtVE2la3/aYxj4iRjCbwuF+r60XRJYacgmVNtdRBcKYl2erVglwbhwfKXmDC
Ayr9sR8XwkhAVR/UqjqtyYgzRjcwuIllD3ys7VoC+8tdSeRkckGCj5Rlr64IXjYi
unK0CijMbK0rty0Cx6rexNvMmOLBfjkKQUEAngcQoELy6xsRrErKQDN4Wytj7iqX
Gwoy1mb9aawqA3COHOJud+JgUQUUfkcUm9fSF/gB8WTYu1gOPrhM9Yiqy28b6IdN
0lldT+QUSU6W+LsxEkFSpnm964tvDTycJGMrsCYdl/KgNxGN77PJVP9lhj0TTscq
53a4eCjD4B1Yv2YlnJOdaD3bYEyEA2Xy9lYCja2TzfrZIOpdNngBjIdqJhLiXDlr
5WZRb26Q+vS0lI4FAzqI6oPOlKbx180id0hzUbFz6RkZVGRG1sHUpEoE75ta4qGr
a6EDfSHQ1WKhMGnlrFLeryjeYqdBjSYPtwFAV6YNoExqc53BwsQ9F13B2CMksjwr
RZxNK6YKTJc7+93FG7cCuc3D1tjr8O7lp2PCKRUq8e465ewxtUdxMn7bxadE9oFT
SVEmuIRMOiLGPcJHndUk17EHAM9aD+pB+qH0US8mDt4G0+jKqOA=o9jr
-----END PGP SIGNATURE-----
Related news
Gentoo Linux Security Advisory 202401-4 - Several vulnerabilities have been found in WebKitGTK+, the worst of which can lead to remote code execution. Versions greater than or equal to 2.42.3:4 are affected.
The vulnerability is among a rapidly growing number of zero-day bugs that major browser vendors have reported recently.
Ubuntu Security Notice 6264-1 - Several security issues were discovered in the WebKitGTK Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service attacks, and arbitrary code execution.
This issue was addressed by restricting options offered on a locked device. This issue is fixed in watchOS 9.5. An attacker with physical access to a locked Apple Watch may be able to view user photos or contacts via accessibility features
A denial-of-service issue was addressed with improved memory handling. This issue is fixed in iOS 16.5 and iPadOS 16.5, macOS Ventura 13.4. Opening a PDF file may lead to unexpected app termination
A permissions issue was addressed by removing vulnerable code and adding additional checks. This issue is fixed in macOS Ventura 13.4. An app may be able to bypass Privacy preferences
A use-after-free issue was addressed with improved memory management. This issue is fixed in watchOS 9.5, iOS 15.7.6 and iPadOS 15.7.6, macOS Ventura 13.4, Safari 16.5, tvOS 16.5, iOS 16.5 and iPadOS 16.5. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
A type confusion issue was addressed with improved checks. This issue is fixed in iOS 16.5 and iPadOS 16.5, macOS Ventura 13.4, watchOS 9.5, tvOS 16.5. An app may be able to execute arbitrary code with kernel privileges
Apple on Wednesday released a slew of updates for iOS, iPadOS, macOS, watchOS, and Safari browser to address a set of flaws it said were actively exploited in the wild. This includes a pair of zero-days that have been weaponized in a mobile surveillance campaign called Operation Triangulation that has been active since 2019. The exact threat actor behind the campaign is not known.
Red Hat Security Advisory 2023-3433-01 - WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Issues addressed include out of bounds read and use-after-free vulnerabilities.
Red Hat Security Advisory 2023-3433-01 - WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Issues addressed include out of bounds read and use-after-free vulnerabilities.
Red Hat Security Advisory 2023-3432-01 - WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Issues addressed include out of bounds read and use-after-free vulnerabilities.
Red Hat Security Advisory 2023-3432-01 - WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Issues addressed include out of bounds read and use-after-free vulnerabilities.
Plus: Microsoft patches two zero-day flaws, Google’s Android and Chrome get some much-needed updates, and more.
Plus: Microsoft patches two zero-day flaws, Google’s Android and Chrome get some much-needed updates, and more.
Steam, the most popular video game storefront on PCs, only recently announced that it was ending support for Windows 7 and 8, and even then, it won’t be official until January.
Steam, the most popular video game storefront on PCs, only recently announced that it was ending support for Windows 7 and 8, and even then, it won’t be official until January.
Categories: Exploits and vulnerabilities Categories: News Tags: Apple Tags: RSR Tags: CVE-2023-32409 Tags: CVE-2023-28204 Tags: CVE-2023-32373 Tags: out of bounds Tags: use after free Apple issued information about patches against three actively exploited zero-days in WebKit. One vulnerability is new, two were patched earlier this month. (Read more...) The post Update now! Apple issues patches for three actively used zero-days appeared first on Malwarebytes Labs.
Categories: Exploits and vulnerabilities Categories: News Tags: Apple Tags: RSR Tags: CVE-2023-32409 Tags: CVE-2023-28204 Tags: CVE-2023-32373 Tags: out of bounds Tags: use after free Apple issued information about patches against three actively exploited zero-days in WebKit. One vulnerability is new, two were patched earlier this month. (Read more...) The post Update now! Apple issues patches for three actively used zero-days appeared first on Malwarebytes Labs.
In an advisory released by the company, Apple revealed patches for three previously unknown bugs it says may already have been used by attackers.
In an advisory released by the company, Apple revealed patches for three previously unknown bugs it says may already have been used by attackers.
Apple on Thursday rolled out security updates to iOS, iPadOS, macOS, tvOS, watchOS, and the Safari web browser to address three new zero-day flaws that it said are being actively exploited in the wild. The three security shortcomings are listed below - CVE-2023-32409 - A WebKit flaw that could be exploited by a malicious actor to break out of the Web Content sandbox. It was addressed with
Apple on Thursday rolled out security updates to iOS, iPadOS, macOS, tvOS, watchOS, and the Safari web browser to address three new zero-day flaws that it said are being actively exploited in the wild. The three security shortcomings are listed below - CVE-2023-32409 - A WebKit flaw that could be exploited by a malicious actor to break out of the Web Content sandbox. It was addressed with